xibosignage xibo-cms

• CVE-2026-50542 Medium 5.4 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure 0.3%
• CVE-2026-50543 Medium 4.3 Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices 0.2%
• CVE-2026-50539 Medium 6.5 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments 0.4%
• CVE-2026-50541 Medium 6.5 Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export 0.4%
• CVE-2026-52729 High 7.1 Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion 0.3%
• CVE-2026-52730 Medium 4.3 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence 0.3%
• CVE-2026-42558 High 7.6 Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet 0.1%
• CVE-2026-42141 High 7.7 Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality 0.4%
• CVE-2026-31956 Medium 4.3 Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization 0.3%
• CVE-2026-31955 Medium 4.9 Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality 0.3%
• CVE-2026-31953 Medium 6.4 Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login 0.1%
• CVE-2026-31952 High 7.6 Xibo CMS API has SQL Injection via DataSet Filter Parameter 0.2%
• CVE-2025-62369 High 7.2 Xibo CMS: Remote Code Execution through module templates 1.0%
• CVE-2024-43413 Low 3.5 Xibo CMS XSS vulnerability using DataSet HTML columns 0.3%
• CVE-2024-43412 Medium 4.6 Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS 0.3%
• CVE-2024-41944 Medium 6.5 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report 0.4%
• CVE-2024-41804 Medium 6.5 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula 0.4%
• CVE-2024-41802 High 8.1 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import 0.5%
• CVE-2024-41803 Medium 4.9 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter 0.4%
• CVE-2024-29022 High 8.8 Session Hijacking via XSS attack in header and session grid in Xibo CMS 0.7%
• CVE-2024-29023 High 7.2 Session Hijacking via token exposure on the session page in Xibo CMS 0.8%
• CVE-2023-33181 Medium 4.3 Sensitive Information Disclosure abusing Stack Trace in Xibo CMS 0.5%
• CVE-2023-33180 Medium 6.5 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map 0.6%
• CVE-2023-33179 Medium 6.5 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter 0.6%
• CVE-2023-33178 Medium 6.5 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter 0.6%
• CVE-2023-33177 High 8.8 Xibo CMS vulnerable to Remote Code Execution through Zip Slip 7.0%